Basic Auth Generator

About Basic auth generator

HTTP Basic authentication sends a username and password as Base64 in the Authorization header, as defined in RFC 7617. This tool builds that header from credentials, gives you ready curl, fetch and axios snippets, and works in reverse to decode a header you captured in a log or a proxy.

How to use it

1. On the Encode tab, enter the Username and Password. Use the eye button to reveal the password.
2. Type the Request URL you want the snippets to target.
3. Copy the Full header line, the Header value, or the bare Base64 credentials.
4. Copy the curl, fetch or axios snippet. To reverse a header, open the Decode tab and paste it.

The RFC 7617 example

Username: Aladdin, Password: open sesame

The header value is the word Basic, a space, then the base64 encoding of Aladdin:open sesame, which is QWxhZGRpbjpvcGVuIHNlc2FtZQ==.

When to use it

• Testing an API endpoint from the command line with a ready-made curl command.
• Decoding an Authorization header found in a proxy log to see which user made a call.
• Producing the header value to paste into a request client or a CI secret.
• Checking why credentials with an accented character or a colon behave differently across clients.

Questions about Basic auth generator

Is Basic authentication encrypted?

No. Base64 is a reversible encoding, so anyone who can see the header can read the password. It is only acceptable over HTTPS, and the Decode tab shows how trivially it is undone.

Can the username contain a colon?

No, because the first colon separates the username from the password. The tool blocks it with an error. A colon inside the password is fine, since decoding splits at the first colon only.

How are non-English characters handled?

The text is encoded as UTF-8 bytes before Base64, so accented and non-Latin characters round-trip correctly. The older btoa function throws on characters above Latin-1 and encodes the rest as Latin-1, not UTF-8.

What can the Decode tab read?

The full header line, just the Basic followed by the payload, or only the Base64 part. It returns the username and password as separate fields, and errors if there is no colon.

Why does the axios snippet look different?

Axios has a built-in auth option that takes the username and password and builds the header itself. The curl and fetch snippets send the precomputed Authorization value directly.

Related tools

• Encryption key generatorGenerate cryptographically secure random keys in hex, Base64, or Base64url.
• Htpasswd generatorCreate Apache .htpasswd entries from a username and password.
• CSP header generatorBuild a Content-Security-Policy header from a directive editor with weakness warnings.
• MD5 GeneratorGenerate an MD5 hash from text
• SHA GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes
• Bcrypt GeneratorGenerate a bcrypt hash from text